fix(sub): address review on external X-HWID

- Serialize first-time id creation with a mutex so concurrent
  first fetches cannot mint two UUIDs.
- Fix goimports grouping for the new third-party import.
- Add externalSubSendHwid opt-out (default send); document it.
- Cover header send/omit with httptest in TestFetchSendsStableHwid.

internal/sub/external_hwid_test.go

@@ -1,6 +1,8 @@
 package sub
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -41,3 +43,43 @@ func TestServerHwidStableAcrossCalls(t *testing.T) {
 		t.Fatalf("persisted hwid %q != returned %q", row.Value, first)
 	}
 }
+
+// The fetch must carry the stable id by default so an HWID-limited donor
+// lets it through, and must drop it when the operator opts out.
+func TestFetchSendsStableHwid(t *testing.T) {
+	if err := database.InitDB(filepath.Join(t.TempDir(), "x-ui.db")); err != nil {
+		t.Fatalf("InitDB: %v", err)
+	}
+	t.Cleanup(func() { _ = database.CloseDB() })
+
+	var gotHwid string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotHwid = r.Header.Get("X-HWID")
+		_, _ = w.Write([]byte("vless://uuid@host:443?security=none#x"))
+	}))
+	defer srv.Close()
+
+	res := fetchSubscriptionLinks(srv.URL)
+	if res.err != nil {
+		t.Fatalf("fetch: %v", res.err)
+	}
+	if len(res.links) != 1 {
+		t.Fatalf("links = %v", res.links)
+	}
+	if gotHwid == "" {
+		t.Fatal("X-HWID header missing on fetch")
+	}
+	if gotHwid != serverHwid() {
+		t.Fatalf("sent %q != stable %q", gotHwid, serverHwid())
+	}
+
+	if err := database.GetDB().Create(
+		&model.Setting{Key: sendHwidKey, Value: "false"}).Error; err != nil {
+		t.Fatalf("opt out: %v", err)
+	}
+	gotHwid = "sentinel"
+	fetchSubscriptionLinks(srv.URL + "/other")
+	if gotHwid != "" {
+		t.Fatalf("X-HWID sent despite opt-out: %q", gotHwid)
+	}
+}